Home / server / Questions / 775544
Accepted
IAmJulianAcosta
Asked: 2016-05-09 16:04:27 +0800 CST

Modify cookie sent from PHP in nginx

  • 772

I have a cookie that I need to be read in Javascript, so I need to remove the httponly part of the cookie from it.

This is the cookie I need to modify:

Set-Cookie: wordpress_c3d46b752402579c18e981091b8c940c=admin%7C1463963639%7CWsIehTVJh4%7C7ee6e8117b6b; expires=Mon, 23-May-2016 12:33:59 GMT; Max-Age=1252800; path=/wp-content/plugins; domain=.example.org; HttpOnly

I just need to strip the HttpOnly string at the end of the cookie

PS: I know that I'm introducing a potential security problem here.

nginx

2 Answers

  1. There are Nginx Lua modules and code snippets that can do this, for example:

    https://github.com/cloudflare/lua-resty-cookie

    First grab the cookie:

    syntax: cookie_val, err = cookie_obj:get(cookie_name)

    You can then set it with httponly false:

    syntax: ok, err = cookie_obj:set({
    key = "Name",
    value = "Bob",
    path = "/",
    domain = "example.com",
    secure = true, httponly = false,
    expires = "Wed, 09 Jun 2021 10:18:14 GMT",
    max_age = 50,
    extension = "a4334aebaec"
})
    • 2
  2. Best Answer

    This is possible using Lua:

    nginx.conf:

    location /foo {
    internal;
    #Do normal stuff that you will do in this location
}

location /bar {
    content_by_lua_block {
        response = ngx.location.capture("/foo")
        for cookieName, cookie in pairs(response.header["Set-Cookie"]) do
            #Modify cookie as needed
        end
    }
}
    • 1